Update to new nodee lib bits (#2120)

internal/daemon/controller/controller.go

@@ -39,8 +39,11 @@ import (
 	"github.com/hashicorp/nodeenrollment/registration"
 	"github.com/hashicorp/nodeenrollment/rotation"
 	nodeefile "github.com/hashicorp/nodeenrollment/storage/file"
+	"github.com/hashicorp/nodeenrollment/types"
+	"github.com/mr-tron/base58"
 	ua "go.uber.org/atomic"
 	"google.golang.org/grpc"
+	"google.golang.org/protobuf/proto"
 )
 
 type Controller struct {
@@ -311,6 +314,7 @@ func (c *Controller) Start() error {
 		event.WriteSysEvent(context.TODO(), op, "already started, skipping")
 		return nil
 	}
+
 	c.baseContext, c.baseCancel = context.WithCancel(context.Background())
 
 	var err error
@@ -406,6 +410,16 @@ func (c *Controller) WorkerStatusUpdateTimes() *sync.Map {
 	return c.workerStatusUpdateTimes
 }
 
-func (c *Controller) AuthorizeNodeeWorker(keyId string) error {
-	return registration.AuthorizeNode(c.baseContext, c.NodeeFileStorage, keyId)
+func (c *Controller) AuthorizeNodeeWorker(request string) error {
+	const op = "controller.(Controller).AuthorizeWorker"
+	reqBytes, err := base58.FastBase58Decoding(request)
+	if err != nil {
+		return fmt.Errorf("(%s) error base64-decoding fetch node creds next proto value", op)
+	}
+	// Decode the proto into the request
+	req := new(types.FetchNodeCredentialsRequest)
+	if err := proto.Unmarshal(reqBytes, req); err != nil {
+		return fmt.Errorf("(%s) error unmarshaling common name value: %w", op, err)
+	}
+	return registration.AuthorizeNode(c.baseContext, c.NodeeFileStorage, req)
 }

internal/daemon/controller/handler.go

@@ -43,8 +43,6 @@ import (
 	"github.com/hashicorp/go-cleanhttp"
 	"github.com/hashicorp/go-secure-stdlib/listenerutil"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
-	"github.com/hashicorp/nodeenrollment"
-	"github.com/hashicorp/nodeenrollment/types"
 	"github.com/mr-tron/base58"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -568,34 +566,6 @@ func wrapHandlerWithCallbackInterceptor(h http.Handler, c *Controller) http.Hand
 func handleNodes(c *Controller) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 		switch req.Method {
-		case http.MethodGet:
-			type vals struct {
-				WaitingNodes []string `json:"waiting_nodes"`
-			}
-			var err error
-			var currVals vals
-			waitingNodes := nodeenrollment.DefaultRegistrationCache.Items()
-			for keyId, val := range waitingNodes {
-				ni := val.(*types.NodeInformation)
-				if ni.Authorized {
-					continue
-				}
-				currVals.WaitingNodes = append(currVals.WaitingNodes, keyId)
-			}
-			ret, err := json.Marshal(currVals)
-			if err != nil {
-				_, _ = w.Write([]byte(err.Error()))
-				w.WriteHeader(500)
-				return
-			}
-			_, err = w.Write(ret)
-			if err != nil {
-				_, _ = w.Write([]byte(err.Error()))
-				w.WriteHeader(500)
-				return
-			}
-			w.WriteHeader(200)
-			return
 
 		case http.MethodPost:
 			body, err := io.ReadAll(req.Body)
@@ -606,7 +576,7 @@ func handleNodes(c *Controller) http.Handler {
 				return
 			}
 			type val struct {
-				KeyId string `json:"key_id"`
+				Request string `json:"request"`
 			}
 			var currVal val
 			if err := json.Unmarshal(body, &currVal); err != nil {
@@ -614,7 +584,7 @@ func handleNodes(c *Controller) http.Handler {
 				w.WriteHeader(500)
 				return
 			}
-			if err := c.AuthorizeNodeeWorker(currVal.KeyId); err != nil {
+			if err := c.AuthorizeNodeeWorker(currVal.Request); err != nil {
 				_, _ = w.Write([]byte(err.Error()))
 				w.WriteHeader(500)
 				return

internal/daemon/controller/intercepting_listener.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/hashicorp/boundary/internal/observability/event"
 	nodee "github.com/hashicorp/nodeenrollment"
-	"github.com/hashicorp/nodeenrollment/nodeauth"
 )
 
 // tempError is an error that satisfies the temporary error interface that is
@@ -79,7 +78,7 @@ func (m *interceptingListener) Accept() (net.Conn, error) {
 
 	tlsConn := conn.(*tls.Conn)
 	switch {
-	case nodeauth.ContainsNodeAuthAlpnProto(tlsConn.ConnectionState().NegotiatedProtocol):
+	case nodee.ContainsKnownAlpnProto(tlsConn.ConnectionState().NegotiatedProtocol):
 		keyId, err := nodee.KeyIdFromPkix(tlsConn.ConnectionState().PeerCertificates[0].SubjectKeyId)
 		if err != nil {
 			if err := conn.Close(); err != nil {

internal/daemon/controller/listeners.go

@@ -17,9 +17,8 @@ import (
 	"github.com/hashicorp/boundary/internal/daemon/controller/internal/metric"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/servers/services"
 	"github.com/hashicorp/go-multierror"
-	nodee "github.com/hashicorp/nodeenrollment"
 	"github.com/hashicorp/nodeenrollment/multihop"
-	"github.com/hashicorp/nodeenrollment/nodeauth"
+	"github.com/hashicorp/nodeenrollment/protocol"
 	"google.golang.org/grpc"
 )
 
@@ -106,18 +105,16 @@ func (c *Controller) configureForApi(ln *base.ServerListener) ([]func(), error)
 }
 
 func (c *Controller) configureForCluster(ln *base.ServerListener) (func(), error) {
-	l, err := nodeauth.NewInterceptingListener(
-		ln.ClusterListener,
-		&tls.Config{
-			GetConfigForClient: c.validateWorkerTls,
-		},
-		nodeauth.MakeCurrentParametersFactory(
-			c.baseContext,
-			nodee.NopTransactionStorage(c.NodeeFileStorage),
-		),
-		nil,
-		nil,
-	)
+	const op = "controller.configureForCluster"
+	l, err := protocol.NewInterceptingListener(
+		&protocol.InterceptingListenerConfiguration{
+			Context:      c.baseContext,
+			Storage:      c.NodeeFileStorage,
+			BaseListener: ln.ClusterListener,
+			BaseTlsConfiguration: &tls.Config{
+				GetConfigForClient: c.validateWorkerTls,
+			},
+		})
 	if err != nil {
 		return nil, fmt.Errorf("error instantiating node auth listener: %w", err)
 	}
@@ -145,9 +142,14 @@ func (c *Controller) configureForCluster(ln *base.ServerListener) (func(), error
 	pbs.RegisterServerCoordinationServiceServer(workerServer, workerService)
 	pbs.RegisterSessionServiceServer(workerServer, workerService)
 
-	multihopService := handlers.NewMultihopServiceServer(
-		nodeauth.MakeCurrentParametersFactory(c.baseContext, nodee.NopTransactionStorage(c.NodeeFileStorage)),
+	multihopService, err := handlers.NewMultihopServiceServer(
+		c.NodeeFileStorage,
+		true,
+		nil,
 	)
+	if err != nil {
+		return nil, fmt.Errorf("%s: error creating multihop service handler: %w", op, err)
+	}
 	multihop.RegisterMultihopServiceServer(workerServer, multihopService)
 
 	metric.InitializeClusterCollectors(c.conf.PrometheusRegisterer, workerServer)

internal/daemon/controller/listeners_test.go

@@ -23,6 +23,7 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/base62"
 	"github.com/hashicorp/go-secure-stdlib/configutil/v2"
 	"github.com/hashicorp/go-secure-stdlib/listenerutil"
+	nodeefile "github.com/hashicorp/nodeenrollment/storage/file"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
 	"google.golang.org/protobuf/proto"
@@ -250,6 +251,9 @@ func TestStartListeners(t *testing.T) {
 			c.baseContext = ctx
 			c.baseCancel = cancel
 
+			c.NodeeFileStorage, err = nodeefile.NewFileStorage(c.baseContext)
+			require.NoError(t, err)
+
 			err = c.startListeners()
 			require.NoError(t, err)